fix: verify Windows release artifact namespace

[seonghobae]

Purpose

Repair the PR-executable release artifact verifier after the merged actions/download-artifact v8 compatibility line exposed an exact platform-namespace mismatch.

Exact failure and root cause

On PR #214 exact head a6cfd32e1c56ea12bddcfdd3f5caff9d6f95e9f6, Release run 32936765719 built and uploaded Linux, Windows, and macOS artifact sets successfully. The download-artifact-pr-compat job 98083412428 downloaded the v8 artifact family successfully and then failed only in Verify downloaded release artifact contract.

The release matrix uploads artifacts under release-disksage-${{ matrix.os }}-${{ github.run_attempt }} and the Windows matrix key is windows-2022. The verifier instead required release-disksage-windows-latest-${run_attempt}, so a correct downloaded artifact set could never satisfy the directory contract.

Test-first repair

1. Add a real Vitest regression that materializes the complete 17-file release artifact set under the exact current matrix namespaces (ubuntu-22.04, windows-2022, macos-latest) and executes the source-controlled Bash verifier.
2. Change only the Windows expected namespace in .github/scripts/verify-release-artifacts.sh from windows-latest to windows-2022.

The verifier's exact file cardinality, bundle types, six operational CLI artifacts, six adjacent SHA-256 records, checksum validation, non-regular-path rejection, and read-only PR compatibility authority remain unchanged.

Authority boundary

This adds no tag, release-publication, package-publication, attestation, secret, or write authority to pull requests. It only repairs the read-only compatibility proof already introduced by the merged #230 line.

Addresses #242.

Required before integration

Keep Draft until the unchanged exact head proves the real download-artifact-pr-compat job succeeds on the downloaded Linux/Windows/macOS release artifacts, all applicable current Test/Release/Security/SAST and central required workflows are terminal-success, current valid findings are addressed, live review/ruleset requirements are satisfied, and repository-wide exact production coverage requirements are not weakened. Pending, skipped-required, failed, stale, predecessor, status-only, or synthetic evidence is non-passing.

Summary by CodeRabbit

• 개선 사항

  • 릴리스 아티팩트를 플랫폼별 예상 디렉터리에서 정확히 검증하도록 개선했습니다.
  • 검증 실패 시 SBOM 및 출처 정보의 생성과 업로드가 중단됩니다.
  • Windows 릴리스 아티팩트 경로 검증을 최신 실행 환경에 맞게 조정했습니다.

• 테스트

  • 번들, CLI 및 체크섬 파일의 잘못된 배치를 감지하는 검증 테스트를 추가했습니다.
  • 릴리스 검증이 SBOM 생성보다 먼저 수행되는지 확인합니다.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 58 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 514b1c68-d934-47e5-babc-6c9192001678

📥 Commits

Reviewing files that changed from the base of the PR and between 79067c1 and d932e32.

📒 Files selected for processing (4)

• .github/scripts/verify-release-artifacts.sh
• .github/workflows/release.yml
• src/lib/releaseArtifactVerifierDirectoryContract.test.ts
• src/lib/releaseTagArtifactVerifierContract.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Verified succession audit against current protected main@d2eab47dc5a33082938bc269c28faf2b82e326c4 and reopened successor #308 (fix/release-artifact-namespace-v2@67306e9c262d76d721edde8edf2c38a96e125956): #307 has no remaining unique valid release-verifier behavior that requires reopening. The successor preserves the Windows windows-2022 namespace repair, the exact 17-file platform artifact fixture, cross-platform bundle/CLI rejection, checksum adjacency/integrity, and fail-closed verifier invocation; it additionally rejects bundles nested below the matrix-defined directory. #307's provenance-contract delta is already present on protected main with the newer pinned actions/attest revision and stricter permission assertion, and #308 consumes that current base. Therefore this closed PR is retained as fully superseded rather than treated as an empty/abandoned change. Any future regression should be repaired on #308/current release-verifier owner, not by reviving this predecessor.